CVE-2026-74755

Deferred Deferred - Pending Action

Integer Underflow in Apache bRPC mcpack2pb

Publication date: 2026-10-21

Last updated on: 2026-10-30

Assigner: Apache Software Foundation

Description

An integer underflow in the mcpack2pb component of Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to crash a bRPC server by sending a request containing a string field with a zero value_size. The UnparsedValue::as_string() function computes `_size - 1` without validating `_size`; when value_size is 0 the expression underflows to SIZE_MAX, resize() throws std::length_error, and because the exception is not caught on the request parsing path the process aborts (SIGABRT). Root Cause: In src/mcpack2pb/parser.cpp, UnparsedValue::as_string() resizes the output string to `_size - 1`, where `_size` is the value_size of a string field taken directly from the network data. A value_size of 0 underflows the unsigned size_t, and the subsequent resize() throws an exception that is not caught. Affected Scenarios: bRPC servers that accept nshead frames wired to the ubrpc mcpack2 adaptor (for example the NsheadService + UbrpcMcpack2Adaptor deployment pattern) can be crashed by a single unauthenticated request. Stock open-source bRPC registers the ubrpc/nshead_mcpack protocols as client-only, so default server configurations are not affected. How to Fix: 1. Upgrade bRPC to a version that includes this fix. 2. Apply the patch in PR https://github.com/apache/brpc/pull/3450

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-30

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-09

NVD

CVE-2026-74755

EUVD

EUVD-2026-107180

Affected Vendors & Products

Vendor	Product	Version / Range
Apache Software Foundation	Apache bRPC	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-191	The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.

Attack-Flow Graph

Executive Summary

This vulnerability is an integer underflow in Apache bRPC's mcpack2pb component affecting versions before 1.18.0. It occurs when a remote attacker sends a request with a string field where value_size is set to 0. The UnparsedValue::as_string() function then computes _size - 1, which underflows to SIZE_MAX due to the zero value. This causes resize() to throw a std::length_error exception that crashes the bRPC server process with SIGABRT.

Detection Guidance

Detecting this vulnerability requires checking if your bRPC server is running a vulnerable version (< 1.18.0) and if it uses the nshead_mcpack2 protocol. Inspect server logs for crashes or SIGABRT signals after receiving requests. No specific commands are provided in the context.

Impact Analysis

This vulnerability allows unauthenticated remote attackers to crash bRPC servers by sending a single malicious request. Servers using the NsheadService + UbrpcMcpack2Adaptor deployment pattern are affected. The crash results in denial of service as the server process aborts. Default server configurations are not vulnerable as bRPC registers the protocols as client-only.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it is a denial-of-service issue causing server crashes rather than a data breach or privacy violation. However, repeated crashes could impact service availability, potentially violating availability requirements in GDPR (Article 32) or HIPAA (Security Rule).

Mitigation Strategies

Upgrade bRPC to version 1.18.0 or later to address the integer underflow issue.
Apply the patch from PR https://github.com/apache/brpc/pull/3450 if upgrading is not immediately possible.
Ensure your bRPC server does not use the nshead_mcpack2 adaptor if running an older version.

Hi! I’m here to help you understand CVE-2026-74755. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...